Ivanti Patches Two Connect Secure Zero-Days Chained in Attacks
Original title: Ivanti patches two more Connect Secure zero-days chained in attacks
Ivanti released patches for two new zero-day flaws chained in attacks since October with CISA ordering federal agencies to patch CVE-2026-104935.
Ivanti issued security updates for CVE-2026-111357, a high-severity privilege escalation flaw, and CVE-2026-118527, which allows authenticated file uploads on unpatched devices. These were chained with CVE-2026-104935 in attacks by UTA0576 since at least October 1, enabling unauthenticated root access on ICS devices. Volexity and Defused reported the chaining with no malware deployed. CISA added CVE-2026-104935 to its actively exploited catalog and set a patch deadline.
Unconfirmed: Full scope of affected devices unknown as only exposed instances tracked
- CVE-2026-111357 is a privilege escalation flaw
- CVE-2026-118527 allows authenticated file upload
- UTA0576 chained the flaws for root access on ICS devices
- CISA ordered federal agencies to patch CVE-2026-104935 by the deadline
- Shadowserver tracks over 5,000 exposed Ivanti ICS instances
Impact: Unauthenticated root-level code execution and privilege escalation
| Product | Affected | Fixed in |
|---|---|---|
| Ivanti Connect Secure | — | patches released |
- 1.Upgrade to the latest patched version
- 2.Apply Ivanti's Integrity Checker Tool
- Vendors
- Ivanti
- Products
- Connect SecureICS
- Threat actors
- UTA0576
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-104935 | Auth Bypass to Command Execution in Ivanti Connect Secure | 8.6 | 87% | KEVPoC ×4 | KEV |
| CVE-2026-111357 | Local root privilege escalation in Ivanti Connect Secure 22.8R2.4 | 7.0 | <1% | KEV | KEV |
| CVE-2026-118527 | Predictable identifiers in Ivanti Connect Secure enable file upload | — | — | KEV | — KEV |
From the original article
2 min read at bleepingcomputer.com
Ivanti released security updates to patch two more Connect Secure (ICS) remote access gateway flaws that have been chained in zero-day attacks since at least October 1. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.